Smartphone Data Transfer Protection According to Jurisdiction

128 Pages·2017·10.31 MB·English

DEPARTMENT OF INFORMATION ENGINEERING AND COMPUTER SCIENCE
ICT International Doctoral School
University of Trento, Italy
Smartphone Data Transfer
Protection According to
Jurisdiction Regulations
Mojtaba Eskandari
Advisor
Prof. Bruno Crispo, Universita` degli Studi di Trento, Italy.
Co-Advisor
Dr. Anderson Santana de Oliveira, SAP Labs, Mougins, France.
Examiners
Prof. Francesco Bergadano, Universita` degli Studi di Torino, Italy.
Prof. Luigi Vincenzo Mancini, Sapienza-Universita` di Roma, Italy.
Dr. Roberto Carbone, Fondazione Bruno Kessler, Trento, Italy.
Submission: 31st January 2017, Revision: 24th June 2017, Defense: 3rd July 2017

Abstract
The prevalence of mobile devices and their capability to access high speed
Internet have transformed them into a portable pocket cloud interface. The
sensitivity of a user’s personal data demands adequate level of protection
in the cloud. In this regard, the European Union Data Protection regula-
tions (e.g., article 25.1) restricts the transfer of European users’ personal
data to certain locations. The matter of concern, however, is the enforce-
ment of such regulations. Since cloud service provision is independent of
physical location and data can travel to various servers, it is a challenging
task to determine the location of data and enforce jurisdiction policies.
In this dissertation, first we demonstrate how mobile apps mishandle
personal data collection and transfer by analyzing a wide range of popular
Android apps in Europe. Then we investigate approaches to monitor and
enforce the location restrictions of collected personal data. Since there are
multiple entities such as mobile devices, mobile apps, data controllers and
cloud providers in the process of collecting and transferring data, we study
each one separately. We introduce design and prototyping of a suitable
approach to perform or at least facilitate the enforcement procedure with
respect to the duty of each entity.
Cloud service providers, provide their infrastructure to data controllers
in form of virtual machines or containers; therefore, we design and imple-
mented a tool, named VLOC, to verify the physical location of a virtual
machine in cloud. Since VLOC requires the collaboration of the data con-
4
troller, we design a framework, called DLOC, which enables the end users
to determine the location of their data after being transferred to the cloud
and probably replicated. DLOC is a distributed framework which does not
need the data controller or cloud provider to participate or modify their
systems; thus, it is economical to implement and to be used widely.
Keywords
[Personal Data, Data Transfer, Privacy, Mobile Apps, Cloud]
5
Acknowledgments
All praises to almighty Allah for His unconditional love and countless bless-
ings and throughout my life, in particular, to accomplish this achievement.
I would like to thank my beloved family for their support, love, and prayers.
My dearest brother-like friend Maqsood Ahmad for his sincere, and un-
conditional willingness to help me overcome my shortcomings on several
occasions.
During the almost four years as a Ph.D. student, I was blessed to meet
amazing people who supported me a lot in various ways at the University of
Trento and in my staying in SAP Labs France. First and foremost, I would
like to thank my supervisors, Professor Bruno Crispo and Doctor Anderson
Santana De Oliveira for their excellent guidance and mentor-ship - I love
the way they introduced me to research and shaped me as a researcher. I
would always be grateful for their availability - they were always available
to provide insightful on the research challenges, I faced. I will always be
thankful to them for their nice and easy way of expressing complex aspects
of my research work and the efforts they made on co-authoring our papers.
Second, my colleagues/friends, especially, Waqar Ahmad, Kashif Ahmad,
Attaullah Buriro, Nasrullah Khair, Sayed Ali Mirheidari, and Mohammad
Lamine who helped and encouraged me in the starting days of my PhD.
I would like to take this opportunity to acknowledge SECENTIS (FP7-
PEOPLE-2012-ITN) project which partly supported this PhD by the EU
under grant 317387.
I would also like to thank the whole Unitn ICT administrative staff
especially Andrea Stenico and Francesca Belton for their support and help
in various aspects during my PhD study.
6
Abbreviations
Back Tracking Pattern BT Pattern
Cloud service provider CSP
Data Protection Authority DPA
Distributed data Location tracker in cloud DLoc
European Union EU
European Economic Area EEA
EU Data Protection Directive DPD
EU General Data Protection Regulation GDPR
Google Play Top Apps Downloader GTAD
Infrastructure as a Service IaaS
Message Authentication Code MAC
Personal Data Transfer Location Analyzer PDTLoc
Platform as a Service PaaS
Proof of Retrievability PoR
Round Trip Time RTT
Service Level Agreement SLA
Software as a Service SaaS
Third Party Auditor TPA
Verifier for physical Location of a virtual machine VLOC
Contents
1 Introduction 1
1.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.2 Challenges and Contributions . . . . . . . . . . . . . . . . 4
1.2.1 App Analysis for Data Location Investigation . . . 5
1.2.2 Data Location Enforcement on Mobile Devices . . . 6
1.2.3 Verify the Location of a Virtual Machine in Cloud . 7
1.2.4 Distributed Data Tracking in Cloud . . . . . . . . . 8
1.3 Organization of the Dissertation . . . . . . . . . . . . . . . 9
2 PDTLoc: Data Tracking in App Level 11
2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2.2 Problem Statement . . . . . . . . . . . . . . . . . . . . . . 13
2.3 Data Flow Analysis . . . . . . . . . . . . . . . . . . . . . . 13
2.4 PDTLoc . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2.4.1 Overview . . . . . . . . . . . . . . . . . . . . . . . 17
2.4.2 Static Analysis Module . . . . . . . . . . . . . . . . 18
2.4.3 Dynamic Analysis Module . . . . . . . . . . . . . . 21
2.4.4 Location Investigator . . . . . . . . . . . . . . . . . 22
2.5 Empirical Analysis . . . . . . . . . . . . . . . . . . . . . . 23
2.5.1 Dataset Collection . . . . . . . . . . . . . . . . . . 23
2.5.2 GTAD . . . . . . . . . . . . . . . . . . . . . . . . . 24
2.5.3 Experimental Setup . . . . . . . . . . . . . . . . . . 26
i
ii CONTENTS
2.5.4 Evaluation Goals . . . . . . . . . . . . . . . . . . . 27
2.6 Results and Discussions . . . . . . . . . . . . . . . . . . . 27
2.6.1 Personal Data Accessed . . . . . . . . . . . . . . . 27
2.6.2 Contacted Servers . . . . . . . . . . . . . . . . . . . 29
2.6.3 Server Locations . . . . . . . . . . . . . . . . . . . 31
2.6.4 Privacy Discussion . . . . . . . . . . . . . . . . . . 33
2.7 Data Location Enforcement on Mobile Devices . . . . . . . 35
2.7.1 Xposed . . . . . . . . . . . . . . . . . . . . . . . . . 35
2.7.2 The Enforcer module designed on top of Xposed . . 36
2.8 Improving Transparency and Compliance . . . . . . . . . . 37
2.9 Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . 38
2.10 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . 39
2.10.1 Static Privacy Leak Detection . . . . . . . . . . . . 39
2.10.2 Dynamic Privacy Leak Detection . . . . . . . . . . 41
2.11 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . 42
3 VLoc: Verify the Location of a Virtual Machine in Cloud 43
3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . 43
3.2 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . 45
3.3 VLOC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
3.3.1 System Model . . . . . . . . . . . . . . . . . . . . . 48
3.3.2 Determining the Location of a Virtual Machine . . 50
3.3.3 Security Considerations . . . . . . . . . . . . . . . . 59
3.3.4 Limitations . . . . . . . . . . . . . . . . . . . . . . 60
3.4 Empirical Setup . . . . . . . . . . . . . . . . . . . . . . . . 61
3.4.1 Data Collection . . . . . . . . . . . . . . . . . . . . 61
3.4.2 Evaluation Measure . . . . . . . . . . . . . . . . . . 62
3.4.3 Accuracy . . . . . . . . . . . . . . . . . . . . . . . 63
3.5 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . 67
CONTENTS iii
4 Distributed Data Tracking in Cloud 69
4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . 69
4.2 DLoc . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
4.2.1 Estimating the data location . . . . . . . . . . . . . 77
4.3 Empirical Evaluation . . . . . . . . . . . . . . . . . . . . . 78
4.3.1 Dataset Collection . . . . . . . . . . . . . . . . . . 80
4.3.2 Evaluation Goals . . . . . . . . . . . . . . . . . . . 80
4.3.3 Evaluation Measure . . . . . . . . . . . . . . . . . . 81
4.3.4 Results and Discussions . . . . . . . . . . . . . . . 82
4.4 Security and privacy analysis . . . . . . . . . . . . . . . . 85
4.5 Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . 86
4.6 Related Work . . . . . . . . . . . . . . . . . . . . . . . . . 86
4.6.1 Server side data geolocation . . . . . . . . . . . . . 87
4.6.2 Delay based data geolocation . . . . . . . . . . . . 87
4.7 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . 90
5 Migration to industry 93
5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . 93
5.2 Industry (SAP) . . . . . . . . . . . . . . . . . . . . . . . . 95
5.3 Standardization Bodies . . . . . . . . . . . . . . . . . . . . 96
5.4 Open-source Software . . . . . . . . . . . . . . . . . . . . . 97
6 Conclusions and Future Work 99
Bibliography 101